NikTech AI — Engineering notes https://niktechai.com/blog/ Field notes on shipping AI agents against real enterprise data. en-us The credential you never created can't leak https://niktechai.com/blog/zero-credential-workers/ https://niktechai.com/blog/zero-credential-workers/ Reaching object storage from an edge function via the S3 API puts access keys inside the function. Native bindings remove the secret from the system entirely. 2026-08-25 A TLS handshake failure usually means the service was never provisioned https://niktechai.com/blog/tls-handshake-means-not-provisioned/ https://niktechai.com/blog/tls-handshake-means-not-provisioned/ TLS errors against a managed cloud endpoint are rarely certificate problems. Usually the subdomain was never provisioned for your account. 2026-08-25 Sieve rules don't run on imported or fetched mail https://niktechai.com/blog/sieve-rules-fetched-mail/ https://niktechai.com/blog/sieve-rules-fetched-mail/ Your Sieve filter is correct and still does nothing. Sieve fires on delivery — mail pulled from another provider bypasses it entirely. 2026-08-25 Your launchd agent can't reach the LAN, and macOS won't tell you why https://niktechai.com/blog/launchd-macos-local-network-block/ https://niktechai.com/blog/launchd-macos-local-network-block/ A LaunchAgent gets "All connection attempts failed" on your own network while the same code works in a shell. macOS enforces this per binary. 2026-08-25 The five rungs of agent engineering https://niktechai.com/blog/five-rungs-of-agent-engineering/ https://niktechai.com/blog/five-rungs-of-agent-engineering/ Prompt, context, loop, graph, ownership. Most teams stall on rung one and wonder why their AI never leaves the demo. A ladder for what to fix next. 2026-08-25 Make your agent fail closed https://niktechai.com/blog/fail-closed-agent-tools/ https://niktechai.com/blog/fail-closed-agent-tools/ The worst agent bug isn't a wrong answer — it's a confident answer built on a tool that quietly returned nothing. A design rule, and where to enforce it. 2026-08-25 Your Fabric data agent is answering from world knowledge — and not telling you https://niktechai.com/blog/fabric-data-agent-world-knowledge/ https://niktechai.com/blog/fabric-data-agent-world-knowledge/ An on-behalf-of identity mismatch makes enterprise retrieval fail silently, so the model answers from world knowledge instead. It looks right. It isn't. 2026-08-25 Cloudflare Pages returns 200 for pages that don't exist https://niktechai.com/blog/cloudflare-pages-soft-404/ https://niktechai.com/blog/cloudflare-pages-soft-404/ Without a 404.html, Pages serves your homepage with HTTP 200 for every unknown URL. Google reads that as an infinite site of duplicates. One file fixes it. 2026-08-25 Capability URLs vs OAuth for a personal MCP server https://niktechai.com/blog/capability-urls-vs-oauth-mcp/ https://niktechai.com/blog/capability-urls-vs-oauth-mcp/ OAuth is right for a product. For a single-user MCP server it can be why the thing never ships. What a capability URL actually costs you, stated plainly. 2026-08-25